ClawHub
Back to skill

Security audit

Alibabacloud Vms Smart Call By Tts

Security checks for vulnerabilities and agentic risk

Overview

This skill is built for real Alibaba Cloud voice calls, but it can place calls with too little confirmation and includes under-scoped credential and install helpers.

Review carefully before installing. Use only a tightly scoped RAM user or short-lived STS profile, avoid root or broad Alibaba Cloud profiles, do not enable debug on the fallback RPC script, and require an explicit final confirmation showing the intended recipient and message before any call is placed.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)

T08 · Insecure Dependencies

Error
Location
scripts/install_aliyun_cli.sh:70
Finding

Unverified Remote CLI Binary Is Downloaded and Installed

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/dyvmsapi_rpc.py:184
Finding

Credential-Bearing RPC Requests Can Be Redirected to an Arbitrary Endpoint

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/dyvmsapi_rpc.py:226
Finding

Debug Output Discloses STS Tokens, AccessKey IDs, and Call Intent

Content
View full analysis
str: sorted_items = sorted(params.items(), key=lambda kv: kv[0]) canonical_qs = "&".join( f"{percent_encode(k)}={percent_encode(v)}" for k, v in sorted_items ) string_to_sign = f"{method}&{percent_encode('/')}&{percent_encode(canonical_qs)}" key = (access_key_secret + "&").encode("utf-8") digest = hmac.new(key, string_to_sign.encode("utf-8"), hashlib.sha1).digest() return base64.b64encode(digest).decode("utf-8"), string_to_sign ``` ```python signature, string_to_sign = build_signature( args.method, all_params, args.access_key_secret ) all_params["Signature"] = signature if args.debug: print(f"[DEBUG] StringToSign = {string_to_sign}", file=sys.stderr) ``` ### Technical Analysis The canonical signing string is constructed from all RPC parameters. Those parameters include the AccessKey ID, optional `SecurityToken`, API action, timestamp, nonce, and business parameters such as `UserMessage`. When `--debug` is enabled, the complete percent-encoded signing string is written to standard error without redaction. Percent encoding is reversible and does not protect sensitive values. This behavior contradicts the documentation's assertion that credentials never appear in debug output. Standard error is commonly captured by agent execution logs, CI systems, terminal recorders, troubleshooting bundles, and monitoring platforms. The AccessKey secret is not directly included in the signing string, but the STS security token and AccessKey ID are exposed in full. ### Attack Path 1. A user, agent, CI job, or support procedure invokes the RPC client with `--debug`. 2. The helper loads an AK or STS profile and injects cr ...[truncated 958 chars]
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
scripts/run_with_aliyun_creds.py:218
Finding

Generic Subprocess Wrapper Exposes Alibaba Cloud Credentials to Arbitrary Commands

Content
View full analysis
[...]", file=sys.stderr, ) sys.exit(5) env = build_env(prof, name, mode, os.environ) announce(prof, name, mode) # Use os.execvpe to replace the current process; the child's exit code is # propagated naturally. try: os.execvpe(cmd[0], cmd, env) except FileNotFoundError: print( f"[run_with_aliyun_creds] ERROR: executable not found: {cmd[0]}", file=sys.stderr, ) sys.exit(127) ``` ### Technical Analysis The helper reads plaintext Alibaba Cloud credentials from the current CLI profile and inserts them into a copied environment. It then executes any command supplied after `--`. There is no validation that: - The executable is the bundled `scripts/dyvmsapi_rpc.py` - The executable path resolves inside the reviewed project - The requested API action is one of the two declared operations - The child is trusted to receive long-lived AK/SK credentials - The child avoids forwarding or persisting its environment This design converts a narrowly scoped credential adapter into a generic credential-bearing process launcher. Documentation directs agents to use one specific command, but documentation is not an enforceable security boundary. ### Attack Path 1. An attacker, malicious instru ...[truncated 1433 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (42)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill also performs credential-profile inspection and instructs the use of a helper that injects Alibaba Cloud credentials into subprocess environments, yet this sensitive behavior is not clearly declared in the skill's purpose. Hidden credential handling materially raises the risk of privilege misuse, accidental leakage, or abuse through arbitrary subcommand execution under cloud credentials.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill also performs credential-profile inspection and instructs the use of a helper that injects Alibaba Cloud credentials into subprocess environments, yet this sensitive behavior is not clearly declared in the skill's purpose. Hidden credential handling materially raises the risk of privilege misuse, accidental leakage, or abuse through arbitrary subcommand execution under cloud credentials.

Content

No source excerpt is available for this finding.

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.

text

  > **Notes**:
  > - **Do not** run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` to install the CLI: piping a remote script directly to a shell **bypasses integrity verification and is treated as a security violation** by static scanners; that script also writes to `/usr/local/bin/aliyun` and silently retries with `sudo`, which fails in non-interactive shells (agent sandboxes, CI runners) where no tty is available to type the password. The installer above downloads only the **signed binary tarball**, never executes a remote script, and routes around the sudo issue.
  > - On Apple Silicon Macs the installer pulls `aliyun-cli-macosx-latest-arm64.tgz`; **never** install the `amd64` build on arm64 hardware — it requires Rosetta 2 and is brittle.
  > - **Verify before continuing**: the installer exits non-zero if the resulting `aliyun version` is < `3.3.8`. If it fails, switch to the manual matrix in [`references/cli-installation-guide.md`](./references/cli-installation-guide.md) (it covers macOS amd64/arm64, Linux amd64/arm64, and Windows, each with a sudo-less variant).

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 357)May include surrounding context.

md
- For error handling, see the error-code table in `references/related-commands.md`

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 452)May include surrounding context.

md
- For error handling, see the error-code table in `references/related-commands.md`

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 468)May include surrounding context.

md
- For error handling, see the error-code table in `references/related-commands.md`

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 489)May include surrounding context.

md
- For error handling, see the error-code table in `references/related-commands.md`

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 115)May include surrounding context.

` is not writable.

bash
DEST="$HOME/.local/bin"
mkdir -p "$DEST"

case "$(uname -m)" in
  x86_64|amd64) ARCH=amd64 ;;
  aarch64|arm64) ARCH=arm64 ;;
  *) echo "Unsupported arch: $(uname -m)" >&2; exit 1 ;;
esac

curl -fsSL "https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-${ARCH}.tgz" \
  | tar -xz -C "$DEST"
chmod +x "$DEST/aliyun"

export PATH="$DEST:$PATH"
grep -qsF "$DEST" ~/.bashrc || echo "export PATH=\"$DEST:\$PATH\"" >> ~/.bashrc

hash -r
aliyun version

Windows

Using Binary

  1. Download from: https://aliyuncli.alicdn.com/aliyun-cli-windows-latest-amd64.zip
  2. Extract the ZIP file
  3. Add the directory to your PATH environment variable
  4. Open new Command Prompt or PowerShell
  5. Verify: aliyun version

Using PowerShell

powershell
# Download
Invoke-WebRequest -Uri "https://aliyuncli.alicdn.com/aliyun-cli-windows-latest-amd64.zip" -OutFile "aliyun-cli.zip"

# Extract
Expand-Archive -Path aliyun-cli.zip -DestinationPath C:\aliyun-cli

# Add to PATH at th

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/plugin-troubleshooting.md (reported line 125)May include surrounding context.

Option 2 — Quarantine the broken directory by RENAMING it (NOT deleting it).

This preserves AK/STS credentials, plugins, and ai-mode config in a timestamped backup

so they can be recovered later (e.g. cp ~/.aliyun.bak.<ts>/config.json ~/.aliyun/).

Never run rm -rf ~/.aliyun — it is irrecoverable and a static-scanner red flag.

mv ~/.aliyun ~/.aliyun.bak."$(date +%Y%m%d-%H%M%S)"

Then re-run aliyun configure to create a fresh profile.

text

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/plugin-troubleshooting.md (reported line 125)May include surrounding context.

Option 2 — Quarantine the broken directory by RENAMING it (NOT deleting it).

This preserves AK/STS credentials, plugins, and ai-mode config in a timestamped backup

so they can be recovered later (e.g. cp ~/.aliyun.bak.<ts>/config.json ~/.aliyun/).

Never run rm -rf ~/.aliyun — it is irrecoverable and a static-scanner red flag.

mv ~/.aliyun ~/.aliyun.bak."$(date +%Y%m%d-%H%M%S)"

Then re-run aliyun configure to create a fresh profile.

text

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/plugin-troubleshooting.md (reported line 125)May include surrounding context.

Option 2 — Quarantine the broken directory by RENAMING it (NOT deleting it).

This preserves AK/STS credentials, plugins, and ai-mode config in a timestamped backup

so they can be recovered later (e.g. cp ~/.aliyun.bak.<ts>/config.json ~/.aliyun/).

Never run rm -rf ~/.aliyun — it is irrecoverable and a static-scanner red flag.

mv ~/.aliyun ~/.aliyun.bak."$(date +%Y%m%d-%H%M%S)"

Then re-run aliyun configure to create a fresh profile.

text

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/install_aliyun_cli.sh (reported line 11)May include surrounding context.

sh
#    Strategy 1 — Homebrew         (preferred on macOS / Linuxbrew; brew tracks
#                                   updates and removal cleanly).
#    Strategy 2 — User-level binary tarball under  $HOME/.local/bin
#                                  (no sudo, no brew, no `curl | bash`).
#
#  Properties:
#    - Idempotent:    safe to re-run; brew path uses upgrade-or-install,

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

The script downloads an archive from a remote CDN and immediately extracts it into a user-controlled bin directory without validating a cryptographic checksum or signature in the script itself. Although this is not curl|bash, it still trusts network-delivered content at install time; if the CDN, transport path, or artifact is compromised, a malicious aliyun binary could be planted and later executed by the user or agent.

Content

Scanner excerpt · scripts/install_aliyun_cli.sh (reported line 79)May include surrounding context.

sh
log "Strategy 2: downloading signed tarball ${tarball} into ${USER_BIN_DIR}/"
  mkdir -p "$USER_BIN_DIR"
  # `curl -fsSL ... | tar -xz -C ...` extracts the tarball stream to the
  # destination; this is NOT `curl | bash`. No remote script is ever executed.
  curl -fsSL "$url" | tar -xz -C "$USER_BIN_DIR" \
    || fail "Download or extract failed for ${url}"
  chmod +x "${USER_BIN_DIR}/aliyun"

os.system() or os exec-family call

High
Category
Dangerous Code Execution
Confidence
85% confidence
Finding

os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution.

Content

Scanner excerpt · scripts/run_with_aliyun_creds.py (reported line 270)May include surrounding context.

python
# Use os.execvpe to replace the current process; the child's exit code is
    # propagated naturally.
    try:
        os.execvpe(cmd[0], cmd, env)
    except FileNotFoundError:
        print(
            f"[run_with_aliyun_creds] ERROR: executable not found: {cmd[0]}",

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill uses powerful capabilities including shell, network, file access, and environment/credential handling, but it does not declare any explicit tool scope or permission boundaries. That makes it harder for the host agent or reviewer to enforce least privilege and increases the chance of unintended command execution, filesystem changes, or credential exposure during use.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger phrases include broad everyday expressions such as 'AI 打电话', 'smart voice call', and '给某人打电话', which can cause accidental invocation of a skill that places real outbound calls. Because the skill can initiate real-world actions affecting third parties, over-broad activation language materially increases misuse and surprise execution risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill description does not prominently warn that execution may place a real phone call to a contact selected via semantic matching from the user's address book. Without a strong upfront warning, users may not appreciate that the action is external, irreversible, and may reach the wrong recipient if matching is mistaken.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
72% confidence
Finding

The skill instructs persistent local modifications such as installing or overwriting CLI plugins and enabling AI-mode, and it depends on cleanup steps being followed perfectly. Persistent environment changes can outlive the skill session, affect other workflows, and leave the system in a more privileged or altered state than the user expected if execution is interrupted.

Content

Scanner excerpt · SKILL.md (reported line 143)May include surrounding context.

Plugin aliyun-cli-dyvmsapi 0.1.0 installed successfully!

text

> If the output reads `plugin "aliyun-cli-dyvmsapi" is already installed (version X.Y.Z); continuing will replace it with version 0.1.0` → **expected behavior** (overwrite install). Let it finish.
>
> If the output reads `ERROR: invalid flag source-base` → **CLI version is < 3.3.8** and does not understand the flag. Re-run the **environment-aware fallback chain in §1.1** (it auto-picks brew / system-wide / user-level upgrade) to upgrade, then retry §1.3. **[FORBIDDEN]** It is strictly forbidden to switch to §1.alt due to this error — this is a tooling-version issue, not a network issue. The external fallback is reserved for `no such host` / `connection timeout` only.
>

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
97% confidence
Finding

The skill explicitly allows execution without confirmation when the model judges the user's intent to be clear, even though the result is a real outbound call to another person. Autonomous execution is dangerous here because mistakes in intent understanding or contact resolution can trigger harassment, privacy violations, or fraudulent communications without a final human check.

Content

Scanner excerpt · SKILL.md (reported line 291)May include surrounding context.

md
## 5. Parameter Confirmation

> **IMPORTANT: Parameter Confirmation** — Before executing the API call,
> confirm the user's **intent** (who to call + what to convey). If the user's message already makes both clear, no confirmation is needed — proceed directly.
> Do NOT iterate on wording or draft the spoken text — `UserMessage` is an intent description,
> not the final playback script; the server-side LLM generates the actual spoken content (`Model.CallContent`).

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
98% confidence
Finding

The 'zero or one round, then fire' rule minimizes friction at the cost of safety for a high-impact external action. Combined with semantic contact matching and LLM-generated call content, this creates a significant risk of wrong-recipient calls or unintended messages being delivered without robust user verification.

Content

Scanner excerpt · SKILL.md (reported line 321)May include surrounding context.

md
Extract **who** to call and **what** to convey from the user's message. A natural-language reference is sufficient (e.g. "我爸", "Mom", "张经理") — it does **not** need to be the exact Tag literal stored in the address book; the server-side LLM performs **semantic matching** against the user's contact list.

- **Intent already clear** (who + what both unambiguous) → skip confirmation, proceed to Step 2 immediately. Example: "Call my dad and tell him to go grocery shopping" — who=dad, what=go grocery shopping, fire directly.
- **Intent partially unclear** (missing who, or what is too vague to act on) → ask **once** to clarify the missing part, then fire. Example: "Make a call" — who=? what=? ask once.

> **[MUST] Zero or one round, then fire** — `UserMessage` is NOT the verbatim script that will be spoken; it is an intent description fed to the server-side LLM, which generates the actual spoken content. Once who + what are clear (whether from the original message or a single clarification), proceed to Step 2 immediately. Prohibited behaviors:

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 17)May include surrounding context.

md
> | Runtime | Architecture | Recommended Strategy | Why |
> |---|---|---|---|
> | macOS with Homebrew | Apple Silicon (`arm64`) or Intel (`x86_64`) | **macOS · Homebrew** | Managed by `brew`; `brew upgrade` keeps it current; works for both architectures |
> | macOS without Homebrew, **with** sudo | Intel | macOS · Binary (Intel, system-wide) | Standard `/usr/local/bin` install |
> | macOS without Homebrew, **with** sudo | Apple Silicon | macOS · Binary (Apple Silicon, system-wide) | Native arm64 binary; **do not use the `amd64` build on arm64 hardware** |
> | macOS, **no** sudo (agent sandbox, restricted user) | any | macOS · Binary (user-level, no sudo) | Drops into `$HOME/.local/bin` and updates PATH |
> | Linux with sudo (Debian/Ubuntu/CentOS/RHEL) | `amd64` or `arm64` | Linux · Binary (system-wide) | Standard `/usr/local/bin` install |

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 18)May include surrounding context.

md
> | Runtime | Architecture | Recommended Strategy | Why |
> |---|---|---|---|
> | macOS with Homebrew | Apple Silicon (`arm64`) or Intel (`x86_64`) | **macOS · Homebrew** | Managed by `brew`; `brew upgrade` keeps it current; works for both architectures |
> | macOS without Homebrew, **with** sudo | Intel | macOS · Binary (Intel, system-wide) | Standard `/usr/local/bin` install |
> | macOS without Homebrew, **with** sudo | Apple Silicon | macOS · Binary (Apple Silicon, system-wide) | Native arm64 binary; **do not use the `amd64` build on arm64 hardware** |
> | macOS, **no** sudo (agent sandbox, restricted user) | any | macOS · Binary (user-level, no sudo) | Drops into `$HOME/.local/bin` and updates PATH |
> | Linux with sudo (Debian/Ubuntu/CentOS/RHEL) | `amd64` or `arm64` | Linux · Binary (system-wide) | Standard `/usr/local/bin` install |

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 19)May include surrounding context.

md
> | Runtime | Architecture | Recommended Strategy | Why |
> |---|---|---|---|
> | macOS with Homebrew | Apple Silicon (`arm64`) or Intel (`x86_64`) | **macOS · Homebrew** | Managed by `brew`; `brew upgrade` keeps it current; works for both architectures |
> | macOS without Homebrew, **with** sudo | Intel | macOS · Binary (Intel, system-wide) | Standard `/usr/local/bin` install |
> | macOS without Homebrew, **with** sudo | Apple Silicon | macOS · Binary (Apple Silicon, system-wide) | Native arm64 binary; **do not use the `amd64` build on arm64 hardware** |
> | macOS, **no** sudo (agent sandbox, restricted user) | any | macOS · Binary (user-level, no sudo) | Drops into `$HOME/.local/bin` and updates PATH |
> | Linux with sudo (Debian/Ubuntu/CentOS/RHEL) | `amd64` or `arm64` | Linux · Binary (system-wide) | Standard `/usr/local/bin` install |

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 20)May include surrounding context.

md
> | Runtime | Architecture | Recommended Strategy | Why |
> |---|---|---|---|
> | macOS with Homebrew | Apple Silicon (`arm64`) or Intel (`x86_64`) | **macOS · Homebrew** | Managed by `brew`; `brew upgrade` keeps it current; works for both architectures |
> | macOS without Homebrew, **with** sudo | Intel | macOS · Binary (Intel, system-wide) | Standard `/usr/local/bin` install |
> | macOS without Homebrew, **with** sudo | Apple Silicon | macOS · Binary (Apple Silicon, system-wide) | Native arm64 binary; **do not use the `amd64` build on arm64 hardware** |
> | macOS, **no** sudo (agent sandbox, restricted user) | any | macOS · Binary (user-level, no sudo) | Drops into `$HOME/.local/bin` and updates PATH |
> | Linux with sudo (Debian/Ubuntu/CentOS/RHEL) | `amd64` or `arm64` | Linux · Binary (system-wide) | Standard `/usr/local/bin` install |

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cli-installation-guide.md (reported line 21)May include surrounding context.

md
> | Runtime | Architecture | Recommended Strategy | Why |
> |---|---|---|---|
> | macOS with Homebrew | Apple Silicon (`arm64`) or Intel (`x86_64`) | **macOS · Homebrew** | Managed by `brew`; `brew upgrade` keeps it current; works for both architectures |
> | macOS without Homebrew, **with** sudo | Intel | macOS · Binary (Intel, system-wide) | Standard `/usr/local/bin` install |
> | macOS without Homebrew, **with** sudo | Apple Silicon | macOS · Binary (Apple Silicon, system-wide) | Native arm64 binary; **do not use the `amd64` build on arm64 hardware** |
> | macOS, **no** sudo (agent sandbox, restricted user) | any | macOS · Binary (user-level, no sudo) | Drops into `$HOME/.local/bin` and updates PATH |
> | Linux with sudo (Debian/Ubuntu/CentOS/RHEL) | `amd64` or `arm64` | Linux · Binary (system-wide) | Standard `/usr/local/bin` install |